scap-security-guide July 2013

scap-security-guide@lists.fedorahosted.org

23 participants
61 discussions

Start a nNew thread

[PATCH 0/2] Created bash remediation template: create_services_enabled
by Shawn Wells 15 Jul '13

15 Jul '13

4 6

[PATCH 2/2] Added remediation from create_services_enabled template
by Shawn Wells 15 Jul '13

15 Jul '13

3 4

[PATCH 0/2] updated setuid/setgid OVAL checks
by Jeffrey Blank 15 Jul '13

15 Jul '13

This is a notification of push of (slightly modified) OVAL code submitted by Rui, as described here: https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/0035… Thanks Rui! Ideally we would be able to "pass" any setuid/setgid program that was installed as part of an RPM. Til then, this is a big improvement from the previous check (which could never pass). Furthermore, this is easy for other users to tailor to their environments. It also gets "make validate" (OVAL schematron validation) closer to passing, since it corrects the use of the deprecated check_existence="none_exist" attribute in the unix:file_test. Jeffrey Blank (2): Added line to indicate test output file, to OVAL testing script new versions of unauth suid/sgid OVAL checks .../checks/file_permissions_unauthorized_sgid.xml | 60 ++++++++++++-- .../checks/file_permissions_unauthorized_suid.xml | 86 +++++++++++++++++-- RHEL6/input/checks/testcheck.py | 1 + 3 files changed, 129 insertions(+), 18 deletions(-)

2 4

[PATCH 0/2] Generated remediations for service_*_disabled & package_*_installed
by Shawn Wells 15 Jul '13

15 Jul '13

2 1

[PATCH 0/2] closing in on OVAL schematron validation
by Jeffrey Blank 15 Jul '13

15 Jul '13

This is about taking care of the output from "make validate", which remains a testament to how little motivation exists to maintain OVAL. Jeffrey Blank (2): removal of invalid state child element in /var/log/audit ownership test removal of invalid state child element in world-writable files test .../input/checks/file_ownership_var_log_audit.xml | 8 ++++++-- ...ile_permissions_unauthorized_world_writable.xml | 1 - 2 files changed, 6 insertions(+), 3 deletions(-)

2 3

Question about RHEL-06-000185
by Trevor Vaughan 11 Jul '13

11 Jul '13

All, I've been running in compliance with this rule for quite some time now and I'm noticing that the amount of noise that it produces is simply outrageous. The suggestion is: At a minimum the audit system should collect file permission changes for all users and root. Add the following to "/etc/audit/audit.rules": -a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \ -k perm_mod If the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \ -k perm_mod And here is the output of a normal workstation over about a week of auditing and normal usage: Syscall Summary Report ========================== total syscall ========================== 24907 chmod 15870 chown 11169 rename 7409 open 6462 fchmod 5290 fchown 3687 umount2 1443 setsid 1166 fsetxattr 869 removexattr 456 adjtimex 360 fchmodat 337 lchown 211 setuid 69 mkdir 63 setsockopt 33 unlink 22 setxattr 20 clone 19 execve 7 fchownat 7 mount 7 creat 4 close 4 ioctl 3 symlink 2 mknod 1 rmdir 1 lsetxattr 1 clock_settime 1 capset So, I get why this can be useful. But I'm not so sure that it's useful to know that Pidgin dropped a new temp file every few minutes or that, each time I open a file (and write a temp file), that I did this as a normal user. I just can't see the practicality of going through those top three calls on a regular basis. I'm not necessarily suggesting that this type of thing be dropped but I'd like to understand how auditors won't fall into just ignoring them completely. Thoughts? Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information --

3 5

note for the USGCB tickets
by Jeffrey Blank 11 Jul '13

11 Jul '13

Shawn (et al), The ticketing system shows me you'd opened up a bunch of tickets to add a "New rule" for items which were in the old RHEL 5 USGCB profile. Okay, great, this helps with ensuring there is continuation of that profile/baseline with some consistency. A few notes: 1) I've been able to close some of the tickets as "fixed", providing explanation as to why. Some of them are being handled through other mechanisms for RHEL 6. 2) If anybody starts executing on the other tickets, the goal is NOT to add new rules as the ticket says, but rather to conduct investigation to see if the Rule is applicable to RHEL 6 in the same way it was applicable to RHEL 5. 3) In the ticket titles, there is some of the odd CCE language which talks about disabling/enabling things "as appropriate". That's fine as an identifier (and the RHEL 6 USGCB did use some of this language). However, this style of language, which is intended for neither a human nor a machine, should never appear in the project's XCCDF. (Just in case anybody gets any ideas.) Thanks, Jeff -- ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance

5 10

Suggestion for RHEL-06-000198
by Trevor Vaughan 11 Jul '13

11 Jul '13

All, Currently the remediation text for RHEL-06-000198 reads as: At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid programs: # find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null Then, for each setuid program on the system, add a line of the following form to "/etc/audit/audit.rules", where [SETUID_PROG_PATH] is the full path to each setuid program in the list: -a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged I would like to suggest that this be changed to Add the following to audit.rules: -a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec -a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec -a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec -a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec >From my testing, this appears to catch the execution of all suid/sgit binaries without digging all over the system to figure out what they are. As an added bonus, you get to find out about binaries that pop onto your system for a brief period. Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information --

4 5

[PATCH] Removing '\' from audit rule lines to prevent confusion.
by Maura Dailey 09 Jul '13

09 Jul '13

Attempting to copy and paste the auditing rules as is into /etc/audit/audit.rules won't work if the '\' characters are left in. Experienced sysadmins MIGHT catch this and remove them, but in my opinion, the benefit of having tidier printouts of auditing rules doesn't outweigh the risk that users will be unable to correctly diagnose the resulting errors if they copy and paste from the HTML version of the guide. No mention is given anywhere in the prose that these line extension characters should be removed, and users that are unfamiliar with audit rule formatting might assume that the '\' characters are a required field. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/system/auditing.xml | 107 +++++++++++++-------------------------- 1 files changed, 35 insertions(+), 72 deletions(-) diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index 1c907bd..e9cac2c 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -750,22 +750,14 @@ calls. Additionally, these rules can be configured in a number of ways while still achieving the desired effect. An example of this is that the "-S" calls could be split up and placed on separate lines, however, this is less efficient. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat \ - -F auid>=500 -F auid!=4294967295 -k perm_mod - -a always,exit -F arch=b32 -S chown -S fchown -S fchownat \ - -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod - -a always,exit -F arch=b32 -S setxattr -S lsetxattr \ - -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \ - -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod + -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod + -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If your system is 64 bit then these lines should be duplicated and the arch=b32 replaced with arch=b64 as follows: -<pre>-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat \ - -F auid>=500 -F auid!=4294967295 -k perm_mod - -a always,exit -F arch=b64 -S chown -S fchown -S fchownat \ - -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod - -a always,exit -F arch=b64 -S setxattr -S lsetxattr \ - -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr \ - -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod + -a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod + -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. @@ -777,11 +769,9 @@ abuse among both authorized and unauthorized users.</rationale> <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <rationale>The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications @@ -805,11 +795,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="chown" /> @@ -833,11 +821,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="fchmod" /> @@ -861,11 +847,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="fchmodat" /> @@ -889,11 +873,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="fchown" /> @@ -917,11 +899,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="fchownat" /> @@ -945,11 +925,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="fremovexattr" /> @@ -973,11 +951,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="fsetxattr" /> @@ -1001,11 +977,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="lchown" /> @@ -1029,11 +1003,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="lremovexattr" /> @@ -1057,11 +1029,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="lsetxattr" /> @@ -1085,11 +1055,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="removexattr" /> @@ -1113,11 +1081,9 @@ calls with others as identifying earlier in this guide is more efficient. <description>At a minimum the audit system should collect file permission changes for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>: -<pre>-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> If the system is 64 bit then also add the following: -<pre>-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 \ - -k perm_mod</pre> +<pre>-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod</pre> </description> <ocil> <audit-syscall-check-macro syscall="setxattr" /> @@ -1176,10 +1142,8 @@ as an attacker attempting to remove evidence of an intrusion.</rationale> unauthorized file accesses for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as appropriate for your system: -<pre>-a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \ - -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access --a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \ - -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access</pre> +<pre>-a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access +-a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access</pre> </description> <ocil clause="either command lacks output"> To verify that the audit system collects unauthorized file accesses, run the following commands: @@ -1250,8 +1214,7 @@ loss.</rationale> deletion events for all users and root. Add the following to <tt>/etc/audit/audit.rules</tt>, setting ARCH to either b32 or b64 as appropriate for your system: -<pre>-a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \ - -F auid>=500 -F auid!=4294967295 -k delete</pre> +<pre>-a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete</pre> </description> <ocil> <audit-syscall-check-macro syscall="unlink" /> -- 1.7.1

3 2

[PATCH] Removing backslash from audit rule lines to prevent confusion.
by Maura Dailey 08 Jul '13

08 Jul '13

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2013